# Rsyslog app name

**URL:** <https://community.graylog.org/t/rsyslog-app-name/27053>\
**Category:** Graylog Central (peer support)\
**Tags:** documentation, filebeat-linux, access-specific-log-, dashboards, gelf\
**Created:** [December 27, 2022, 11:46am UTC](https://community.graylog.org/t/rsyslog-app-name/27053 "2022-12-27T11:46:43Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [December 29, 2022, 7:26pm UTC](https://community.graylog.org/t/rsyslog-app-name/27053/4 "2022-12-29T19:26:52Z")

</div>

This is just the auth collector configuration you can add multiple log files into one collector - if you need more help with setting up filebeats, start a new thread… 😃

```auto
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

filebeat.inputs:
- type: filestream
  id: id-linux-auth
  enabled: true
   paths:
    - /var/log/auth.log
  tags:
    - linux
  logging.metrics.enabled: false
  fields:
    os_ver: ubuntu

output.logstash:
   hosts: 
   - ${user.LinuxIn}

path:
  data: /var/cache/graylog-sidecar/filebeat/data
  logs: /var/log/graylog-sidecar

```

---

_[View the full topic](https://community.graylog.org/t/rsyslog-app-name/27053)._